Germany

Debt collection company

—

GDPR enforcement action by Data Protection Authority of Baden-Wuerttemberg on 2022.

Case details

Authority: Data Protection Authority of Baden-Wuerttemberg
Date: 2022
Controller / Processor: Debt collection company
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 6 (1) GDPR, Art. 14 (1), (2) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The DPA from Baden-Württemberg has imposed a fine on a debt collection company. The debt collection company had received investor information from an employee of an insolvent company, which it used to offer its services to assist the affected investors with insolvency claims. However, the DPA found that the company had processed the data without the required legal basis. In addition, the debt collection company failed to provide the data subjects with necessary information, such as the origin of their data.

Open original source Links to the regulator's original publication or another source.